
Security News
pnpm 11.5 Adds Support for Recognizing npm Staged Publishes
pnpm 11.5 now recognizes npm staged publish approvals in release metadata, preventing those releases from being mistaken for lower-trust package publishes.
Zero install. Run any CLI tool with npx supercli.
JSON-first by default. Use --human for readable output.
Think: "Stripe API for CLIs and tools"
Turn any CLI, API, or workflow into a discoverable, executable capability — with consistent inputs, outputs, and zero glue code.
# Discover what exists (JSON by default)
npx supercli skills search "deploy"
# Understand exactly how to use it
npx supercli skills get aws.cfn.deploy
# Execute with predictable output (JSON by default)
npx supercli aws cfn deploy --stack-name my-stack
# For human-readable output, add --human
npx supercli aws cfn deploy --stack-name my-stack --human
👉 Works the same across CLI tools, APIs, MCP servers, and workflows 👉 No glue code, no parsing, no guesswork
npx supercli ask "list my tasks and recent commits"
{
"tasks": [...],
"commits": [...]
}
→ Combines multiple tools into one structured response.
Every tool speaks a different language:
Humans waste time learning syntax. Agents fail because nothing is predictable.
Without supercli, integrating a new tool means:
For agents, the situation is worse — every tool responds differently, errors are unstructured, and there's no way to discover capabilities dynamically.
supercli turns everything into capabilities:
supercli <namespace> <resource> <action>With supercli:
supercli skills search "backup" — no docs neededsupercli inspect <ns> <res> <act> — see every argument, type, and default--json — get structured output every timesupercli ask "do X and Y" — no shell scripting required# Explore capabilities (JSON by default)
npx supercli help
npx supercli skills search "github"
# Run something real (JSON by default)
npx supercli beads issue list
npx supercli gh issue list
# For human-readable output, add --human
npx supercli beads issue list --human
# AI-driven execution
npx supercli ask "show my tasks and recent commits"
# Manage plugins
npx supercli plugins list
npx supercli plugins explore
npx supercli plugins install commiat
# Inspect a capability before using it
npx supercli inspect http check health
# → Shows: args, types, defaults, required/optional, description
💡 Install globally:
npm install -g superaclifor repeated use.
Server mode: See docs/features/server-plugins.md
| Instead of... | You do... |
|---|---|
| Installing 50 tools separately | One command: npx supercli |
| Reading man pages for flags | supercli skills get <tool>.* → structured metadata |
| Parsing inconsistent output | JSON by default, --human for readable output |
| Gluing tools with shell scripts | supercli ask "do X and Y" |
What this means day-to-day:
npx supercli <tool> works immediately, no apt-get, brew, or npm i -g--human for terminal display💡 Important: supercli is JSON-first by default. Add
--humanfor human-readable output in your terminal.
supercli skills search "database" returns machine-readable metadata (JSON by default)--human for readable output, --silent (no interactive prompts)82 (validation), 105 (integration), 110 (internal)supercli ask "check status and send alert" chains tools automaticallysupercli inspect <ns> <res> <act> exposes full argument schemas with types and defaults# Agent workflow: discover → inspect → execute — all machine-readable (JSON by default)
supercli skills search "deploy"
supercli skills get aws.cfn.deploy
supercli aws cfn deploy --stack my-stack
For agent developers: always start with supercli for self-documenting bootstrap — it returns the full capability graph schema (JSON by default). Then use supercli skills search <query> to narrow down, and supercli inspect <ns> <res> <act> before calling any command to validate argument expectations.
supercli turns any tool into a first-class capability with a consistent interface:
supercli skills search "database" returns every matching capability with descriptions, tags, and argument schemas. No man pages, no README hunting.supercli <ns> <res> <action> [--flags]. Learn one pattern, access 4,000+ tools.--human for readable output, and self-describes via inspect. No parsing, no guesswork.supercli ask "check status and send alert" composes multiple capabilities automatically. No shell scripts, no middleware.82 validation, 105 integration, 110 internal) let scripts and agents handle failures deterministically.# Discovery (JSON by default)
npx supercli skills list
npx supercli skills search "database"
# Inspection (important for agents)
npx supercli inspect beads issue create
npx supercli skills get beads.issue.create
# Execution (JSON by default)
npx supercli beads issue create --title "Fix bug"
npx supercli beads issue list
npx supercli gwc drive files list
# For human-readable output, add --human
npx supercli beads issue list --human
# AI
npx supercli ask "do X and Y"
# Plugins
npx supercli plugins list
npx supercli plugins install commiat
npx supercli plugins show commiat
supercli models every tool, API, and workflow as a capability — a named, typed, executable unit with a consistent interface. Capabilities form a graph where each node represents a tool function and edges represent composition possibilities.
The capability graph is the core abstraction. Instead of learning N different tool interfaces, you interact with one graph that routes to the right underlying system. All 4,000+ tools are nodes in this graph, addressable by the same triple pattern.
The router is the central brain that connects user commands to capabilities:
<namespace> <resource> <action> — the same triplet for every tool--json, --human, --compact)The routing pipeline processes every command in four phases:
<namespace> <resource> <action> and separates flags from positional arguments. The same parser handles every command, regardless of the underlying tool.Four adapter types bridge external systems into the capability graph:
| Adapter | What It Wraps | When To Use |
|---|---|---|
| CLI | 4,000+ CLI binaries | Running shell commands with JSON output, timeout management, structured error handling |
| MCP | Model Context Protocol servers | Connecting MCP-compatible tools into the same routing graph |
| HTTP | REST endpoints | Turning any API into a callable capability with configurable methods, headers, and body schemas |
| Workflow | Multi-capability chains | Composing multiple tools via supercli ask "do X and Y", auto-resolving dependencies |
Each adapter normalizes its target into the same internal representation: a capability record with name, description, argument schema, and execution handler. Every tool — whether a CLI binary, an MCP server, or a REST API — looks identical to the router.
The plugin system keeps capabilities organized and discoverable:
plugin.json) with metadata, checksums, commands, and dependency requirements~/.supercli/plugins/plugins.lock.jsonsc-zig) and the Node.js runtime (sc) read the same plugin storage — they co-exist and share stateplugins/catalog.json tracks 4,000+ community plugins with checksum-verified updatessupercli replaces tool-specific syntax with a queryable, executable capability graph — one interface for every tool, discoverable by humans and agents alike.
supercli draws capabilities from bundled plugins (200+, immediate), plugin registry (3,100+, plugins install <name>), MCP servers (mcp add <name>), and HTTP APIs (api add <name>). Every capability includes description, tags, argument schemas, and checksum-verified metadata.
Every command returns a consistent JSON envelope:
{
"version": "1.0",
"command": "http.check.health",
"duration_ms": 142,
"data": { "status": "ok" }
}
| Exit Code | Meaning |
|---|---|
0 | Success |
82 | Validation error |
105 | Integration error |
110 | Internal error |
All tools return JSON by default. Add --human for readable output, --silent for machine-consumable output without prompts.
| Mode | Command | What It Does | When To Use |
|---|---|---|---|
| Direct | <ns> <res> <act> [--flags] | Executes a specific capability with arguments | Running a known tool, scripting |
| Ask | supercli ask "do X and Y" | AI-driven composition chains multiple capabilities | One-shot tasks, complex workflows |
| Inspect | supercli inspect <ns> <res> <act> | Shows argument schema, types, descriptions, defaults | Before running an unfamiliar command |
| Discover | supercli skills search <query> | Searches all capabilities by name, description, tags | Finding what tools are available |
| Server | supercli server | Starts HTTP or MCP server exposing all capabilities | Remote access, IDE integration, API gateway |
All five modes return JSON by default. Add --human for readable display. Agents should always start with supercli for self-documenting bootstrap — it returns the full capability graph schema (JSON by default).
curl -sSL https://github.com/javimosch/supercli/releases/download/v0.1.0-zig/install.sh | bash
~/.supercli/plugins/plugins.lock.json# Run immediately
npx supercli uuid self generate
# Install globally
npm install -g superacli
Both versions co-exist and share plugin storage at ~/.supercli/plugins/plugins.lock.json. Install either (or both) — they read and write the same configuration, so switching between them is seamless. The Zig version is recommended for daily use (faster startup), while the Node.js version provides full MCP and HTTP adapter support.
| Symptom | Likely Cause | Fix |
|---|---|---|
command not found: supercli | Not installed | Run npx supercli (no install needed) or npm install -g superacli |
| Plugin not found | Not in registry | Run supercli plugins explore --name <query> to find it |
| Output is not JSON | Add --json flag | JSON is default, but if you need to force it, add --json |
| MCP server not connecting | Server not running | Ensure the MCP server process is active and accessible |
| Zig binary not found | Wrong platform binary | Use npx supercli (Node.js) as fallback — both share plugin state |
For detailed debugging: supercli returns the full schema (JSON by default). Use supercli inspect <ns> <res> <act> to validate arguments before execution.
supercli help — list all commandssupercli help <namespace> — commands in a namespacesupercli — full capability graph schema (JSON by default)supercli plugins show <name> — plugin details including version, source, tags| Layer | Technology |
|---|---|
| Runtime | Node.js (sc), Zig (sc-zig) — co-exist, share plugin state |
| Router | Custom capability graph with sub-millisecond cache |
| Plugins | 4,022 bundled — each plugin.json + meta.json |
| MCP | Built-in MCP server adapter (supercli mcp add <name>) |
| HTTP | HTTP adapter for REST endpoints as capabilities |
| Registry | plugins/catalog.json — checksum-verified updates |
| CLI | supercli <ns> <res> <action> [--flags] — universal triplet |
| Output | Deterministic JSON envelopes with exit codes |
| AI | supercli ask "do X and Y" — auto-resolves capability chains |
| Install | npx supercli (zero-install) or npm install -g superacli |
| Channel | Link |
|---|---|
| GitHub | github.com/javimosch/supercli |
| npm | superacli on npm |
| Issues | GitHub Issues |
| Discussions | GitHub Discussions |
| Changelog | CHANGELOG |
Contributions are welcome! See CONTRIBUTING.md for guidelines.
plugins/<name>/.⭐ If supercli saved you time, star the repo. Takes one click, means the world to us.
If supercli saved you time, consider supporting the project:
MIT — Javier Leandro Arancibia
FAQs
4,000+ tools. One CLI. Zero configuration.
The npm package superacli receives a total of 28 weekly downloads. As such, superacli popularity was classified as not popular.
We found that superacli demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
pnpm 11.5 now recognizes npm staged publish approvals in release metadata, preventing those releases from being mistaken for lower-trust package publishes.

Security News
Federal audit finds NIST lacked a plan to clear the NVD backlog, wasted funds on duplicate work, and delayed use of CISA data.

Research
/Security News
A mini Shai-Hulud campaign compromised Red Hat Cloud Services npm packages to steal developer and CI/CD secrets during installation.